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CLAIMS: 

What is claimed is: 

1. A method in a data processing system for tracking relationships between programs 
and data, the method comprising: 

receiving a file access request from a program, wherein the request is received at 
an operating system level; and 

storing an association between the file and the program. 

2. The method of claim 1 , wherein the association is stored as meta data. 

3. The method of claim 1, wherein the association includes a file name for the file 
and a program name for the program. 

4. The method of claim 3, wherein the association further includes at least one of a 
location of the file, a time of file access, a date of file access, an extension for the file, and 
an identification of a user of the program. 

5. The method of claim 4, wherein the location of the file is in a remote data 
processing system. 

6. The method of claim 1, wherein the file request is one of a request to open the 
25 file, close the file, copy the file, or delete the file. 
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7. The method of claim 1, wherein the program is a first program and wherein a 
request to open the file originates from the first program and a request to close the file 
originates from a second program. 

5 8. The method of claim 7, wherein the association includes the second program. 

9. The method of claim 1, wherein the receiving step and the storing step are 
performed within an operating system kernel. 

10. The method of claim 1, wherein the receiving step and the storing step are 
performed within a device driver. 

11. The method of claim 10, wherein the drive driver intercepts calls directed to a 
mechanism used as a point of entry for the access. 

12. The method of claim 1, wherein the storing step comprises: 
storing the association between the file and the program in a database. 

13. The method of claim 1, wherein associations are stored in a database and further 
20 comprising: 

receiving a request from a requestor to access the associations; 

querying the database for the associations; 

receiving a result from the database; and 

returning the result returned from the database to the requestor. 

25 

14. The method of claim 13, wherein the associations are for a particular program. 
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15. The method of claim 13, wherein the associations are for a particular file. 

16. The method of claim 1, wherein the storing step comprises: 

storing the association between the file and the program in at least one of a 
registry, file, and a file system. 

17. A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 

a memory connected to the bus system, wherein the memory includes as set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instructions to receive a file access request from a program, wherein 
the request is received at an operating system level; and store an association between the 
file and the program. 

18. The data processing system of claim 17, wherein the bus system is a single bus. 

19. The data processing system of claim 17, wherein the bus system includes a 
primary bus and a secondary bus. 

20. The data processing system of claim 17, wherein the processing unit includes a 
plurality of processors. 
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f 

21. The data processing system of claim 17, wherein the communications unit is one of a 
modem and Ethernet adapter. 

22. A data processing system for tracking relationships between programs and data, 
5 the data processing system comprising: 

receiving means for receiving a file access request from a program, wherein the 
request is received at an operating system level; and 

storing means for storing an association between the file and the program. 

10 23. The data processing system of claim 22, wherein the association is stored as meta 
data. 

24. The data processing system of claim 22, wherein the association includes a file 
name for the file and a program name for the program. 

15 

25. The data processing system of claim 24, wherein the association further includes 
at least one of a location of the file, a time of file access, a date of file access, an 
extension for the file, and an identification of a user of the program. 

20 26. The data processing system of claim 25, wherein the location of the file is in a 
remote data processing system. 

27. The data processing system of claim 22, wherein the file request is one of a 
request to open the file, close the file, copy the file, or delete the file. 

25 
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28. The data processing system of claim 22, wherein the program is a first program 
and wherein a request to open the file originates from the first program and a request to 
close the file originates from a second program. 

29. The data processing system of claim 22, wherein the association includes the 
second program. 

30. The data processing system of claim 22, wherein the receiving means and the 
storing means are performed within an operating system kernel. 

3 1 . The data processing system of claim 22, wherein the receiving means and the 
storing means are performed within a device driver. 

32. The data processing system of claim 31, wherein the drive driver intercepts calls 
directed to a mechanism used as a point of entry for the access. 

33. The data processing system of claim 22, wherein the storing means comprises: 
means for storing the association between the file and the program in a database. 

34. The data processing system of claim 22, wherein associations are stored in a 
database, wherein the receiving means is a first receiving means, and further comprising: 

second receiving means for receiving a request from a requestor to access the 
associations; 

querying means for querying the database for the associations; 
third receiving means for receiving a result from the database; and 
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returning means for returning the result returned from the database to the 
requestor. 

35. The data processing system of claim 34, wherein the associations are for a 
5 particular program. 

36. The data processing system of claim 34, wherein the associations are for a 
particular file. 

37. The data processing system of claim 22, wherein the storing means comprises: 
means for storing the association between the file and the program in at least one 

of a registry, file, and a file system. 

38. A computer program product in a computer readable medium for tracking 
relationships between programs and data, the computer program product comprising: 

first instructions for receiving a file access request from a program, wherein the 
request is received at an operating system level; and 

second instructions for storing an association between the file and the program. 

20 39. The computer program product of claim 38, wherein the association is stored as 
meta data. 

40. The computer program product of claim 38, wherein the association includes a 
file name for the file and a program name for the program. 
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41 . The computer program product of claim 40, wherein the association further 
includes at least one of a location of the file, a time of file access, a date of file access, an 
extension for the file, and an identification of a user of the program. 

5 42. The computer program product of claim 41, wherein the location of the file is in a 
remote data processing system. 

43. The computer program product of claim 38, wherein the file request is one of a 
request to open the file, close the file, copy the file, or delete the file. 

10 

44. The computer program product of claim 38, wherein the program is a first 
program and wherein a request to open the file originates from the first program and a 
request to close the file originates from a second program. 

15 45. The computer program product of claim 38, wherein the association includes the 
second program. 

46. The computer program product of claim 38, wherein the first instructions and the 
second instructions are performed within an operating system kernel. 

20 

47. The computer program product of claim 38, wherein the first instructions and the 
second instructions are performed within a device driver. 

48. The computer program product of claim 47, wherein the drive driver intercepts 
25 calls directed to a mechanism used as a point of entry for the access. 
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49. The computer program product of claim 38, wherein the second instructions 
comprises: 

sub-instructions for storing the association between the file and the program in a 
database. 

50. The computer program product of claim 38, wherein associations are stored in a 
database and further comprising: 

third instructions for receiving a request from a requestor to access the 
associations; 

fourth instructions for querying the database for the associations; 
fifth instructions for receiving a result from the database; and 
sixth instructions for returning the result returned from the database to the 
requestor. 

51. The computer program product of claim 50, wherein the associations are for a 
particular program. 

52. The computer program product of claim 50, wherein the associations are for a 
particular file. 

53. The computer program product of claim 38, wherein the second instructions 
comprises: 

sub-instructions for storing the association between the file and the program in at 
least one of a registry, file, and a file system. 
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